SunPump Meme Token Toolkit

Pass

Audited by Gen Agent Trust Hub on Sep 14, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from the TRON blockchain and SunPump API, such as token metadata and descriptions, which could be used for injection attacks.
  • Ingestion points: Read commands such as sun sunpump token get and sun sunpump token ranking described in SKILL.md.
  • Boundary markers: The skill includes a 'Security Rules' section and an 'Agent Pre-Validation Checklist' that mandate user previews and confirmations.
  • Capability inventory: Subprocess calls to the sun CLI for critical operations like sun swap and sun sunpump launch.
  • Sanitization: Relies on structured --json output for parsing but does not describe internal data sanitization of descriptive fields.
  • [EXTERNAL_DOWNLOADS]: Requires the installation of the @sun-protocol/sun-cli npm package from the public registry.
  • [COMMAND_EXECUTION]: Operates by executing shell commands via the sun CLI to perform blockchain-related tasks, which is the primary intended function of the skill.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 14, 2026, 10:05 PM
Security Audit — agent-trust-hub — SunPump Meme Token Toolkit